---
title: "401 Unauthorized"
canonical: "https://lemwatch.com/http-status-codes/401"
category: "client-error"
last_verified: "2026-08-11"
source: "https://lemwatch.com"
---

# HTTP 401 Unauthorized

**Summary** — Authentication is required and has failed or has not been provided.

## What it means

HTTP 401 Unauthorized means the request lacks valid authentication credentials. Despite the name, it's about authentication (who are you?), not authorisation (what can you do?). The server should include a WWW-Authenticate header indicating the required authentication scheme.

## Common causes

- Missing authentication token
- Expired JWT or session
- Invalid API key
- Incorrect username/password

## How to fix

- Include valid authentication credentials
- Refresh expired tokens
- Check API key validity
- Implement proper token refresh logic

## SEO impact

Content behind authentication is not indexed. Ensure public pages don't require authentication.

## Monitoring tip

LemWatch detects when public pages unexpectedly return 401, which could indicate a misconfigured authentication layer.

**Related:** [400](https://lemwatch.com/http-status-codes/400.md), [403](https://lemwatch.com/http-status-codes/403.md), [407](https://lemwatch.com/http-status-codes/407.md)

_Canonical HTML page: https://lemwatch.com/http-status-codes/401_